ZPA keeps the app off the internet.SSHepherd switches its port off.
Zscaler Private Access is a widely used way to give people access to private applications without a VPN. SSHepherd solves a narrower problem: administrative access to servers, with the server's own ports closed. Here is where they overlap and where they don't.
They agree on morethan most comparisons admit.
Zscaler Private Access (ZPA) is a cloud-delivered zero trust network access (ZTNA) service for user-to-app access. Before the differences, the common ground.
ZPA App Connectors only make outbound connections and need no inbound open ports. The SSHepherd agent also dials out.
ZPA applies context-aware policies per application. SSHepherd admits authorised identities from your SAML, OIDC or Active Directory provider.
Zscaler says apps are never exposed to the public internet. SSHepherd servers answer no scan at all.
Side by side,line by line.
Taken from each vendor's own documentation, checked . Numbers link to the source. The edge on each row says which product its documentation favours, and it goes to Zscaler ZPA where Zscaler ZPA is stronger.
| Capability | SSHepherd® | Zscaler ZPA |
|---|---|---|
| Listening on the protected serverEdge: SSHepherd | Nothing listeningNone. sshd, RDP and TCP/IP application services can be switched off, so nothing on the server waits for an inbound connection. 1 | Still listeningThe application keeps listening on its port (for example 22 for SSH). The App Connector connects to the application server inside your network. 23 |
| A scan from inside your networkEdge: SSHepherd | Nothing to findNo open, listening ports, even while an SSHepherd session is active. 14 | Reachable insideZPA keeps the application off the internet. On the internal network the server still listens on its port, so it stays reachable there unless you also restrict it. 2 |
| What accepts connectionsEven | Your own C3 serverYour SSHepherd C3 server, which you host on Kubernetes (on-premise or cloud). The agent and the user's Control App both connect out to it over TLS. 15 | Zscaler's cloudZscaler's cloud brokers the connection; App Connectors dial out to it. An optional Private Service Edge you host accepts inbound TCP 443. 67 |
| Session recordingEdge: SSHepherd | SSH and RDPSSH and RDP sessions are recorded, with live view and replay. 8 | With the PRA add-onYes for SSH, RDP and VNC sessions run through Zscaler Privileged Remote Access (PRA), a browser-based console that needs PRA authorisation from Zscaler. 910 |
| Ending a live sessionEdge: SSHepherd | ImmediateYes. An administrator watching a live session can terminate it immediately. 8 | With the PRA add-onYes for PRA sessions: an administrator can monitor a live privileged session, and terminate it when the user has an associated privileged approval. 11 |
| What it coversEdge: Zscaler ZPA | SSH, RDP, TCP appsSSH, RDP and TCP/IP applications, on Windows and Linux hosts. 5 | Any TCP/UDP app, OTAny TCP or UDP application you define as an application segment, browser access for web apps, and SSH, RDP and VNC through PRA. Includes OT and IoT access. 312 |
- Clear strength
- With conditions
- Not documented, or still exposed
- No winner
Off the internet is good.Off entirely is better.
Zscaler ZPA keeps the server off the public internet. SSHepherd also takes the service off the network the server sits on, which is where an attacker who has already got in starts looking.
Different jobs.Sometimes both.
Choose Zscaler ZPA if
- Most of your access is people reaching business applications, in many locations, and you want one cloud service for it.
- You are replacing a VPN or VDI estate for the whole workforce.
Choose SSHepherd® if
- Your exposure is the servers themselves: SSH, RDP, databases and file transfer that administrators, vendors and tools reach.
- You want those services switched off on the server, so an attacker already inside the network has nothing to scan.
- You want SSH and RDP sessions recorded and stoppable as part of the same product, hosted on your own infrastructure.
The two can run side by side: ZPA for workforce access to applications, SSHepherd for administrative access to the servers behind them.
Common questions.
Does Zscaler ZPA leave ports open to the internet?
No. ZPA App Connectors make outbound connections only and need no inbound open ports, and Zscaler says applications are never exposed to the public internet. The difference is inside your network, where the application still listens on its port.
Can ZPA record SSH and RDP sessions?
Yes, through Zscaler Privileged Remote Access, which records SSH, RDP and VNC sessions on its privileged consoles and can terminate a live session tied to a privileged approval. PRA needs authorisation from your Zscaler account team.
Is SSHepherd a replacement for ZPA?
Not for workforce access to business applications, which is what ZPA is built for. SSHepherd is built for administrative access to servers, with the server's listening ports closed.
Where does SSHepherd run?
You host the SSHepherd C3 server on Kubernetes, on-premise or in the cloud. Agents on your Windows and Linux servers and the user's Control App both connect out to it.
Sources
- Full Armor: SSHepherd FAQ
- Zscaler Help: Understanding Private Access architecture
- Zscaler Help: Configuring defined application segments
- Full Armor: Make your network traffic invisible to hackers
- Full Armor: System requirements
- Zscaler Help: About Connectors
- Zscaler Help: Private Service Edge deployment prerequisites
- Full Armor: Monitoring sessions
- Zscaler Help: Understanding Privileged Remote Access
- Zscaler Help: Step-by-step configuration guide for Privileged Remote Access
- Zscaler Help: Accessing privileged sessions
- Zscaler: Zscaler Private Access
- US Patent 11,153,340 B1: Elimination of listen ports on a publicly accessible computer
Checked against each vendor's public documentation on 6 October 2026. Products change: if anything here is out of date, email [email protected] and we will correct it. This page compares documented capabilities, not price or performance. Zscaler and Zscaler Private Access (ZPA) are trademarks of their owner; Auris is not affiliated with Zscaler. SSHepherd® is developed by Full Armor Corporation and distributed in Southeast Asia by Auris.
More comparisons: SSHepherd vs Cloudflare · SSHepherd vs Teleport · SSHepherd vs Twingate
See it onyour own servers.
Already running Zscaler ZPA? Tell us what you protect with it and which servers your administrators reach. We will show where SSHepherd fits alongside it, and reply within one business day.